Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have to stage some new laptops for people at work. We are on AD, so I can log in either as local admin, or network admin. This is great for doing a couple things (removing some of the junk the computer comes with, installing some apps that can install for "All Users"), but really, to get it set up for the user it is best to log in as them on the computer, then I can add icons, set defaults etc.

I can reset a users PW, or get them to log in and then take the computer back and continue setting up, but I'm wondering if there is a way to log in as them to make the changes without doing this? Some software lets you create a secondary / temp password, or "act" as a user, but is this possible? Machine is running Win7, Severs are 2008RC2.

Any advice is appreciated.

share|improve this question

migrated from superuser.com Jan 14 '13 at 20:36

This question came from our site for computer enthusiasts and power users.

    
Roaming profiles anyone? –  chewbakka Jan 14 '13 at 20:55
    
Why are you running Release Candidate servers? –  joeqwerty Jan 14 '13 at 23:25
    
Sorry, not what I meant! –  McB Jan 16 '13 at 21:55
add comment

3 Answers

The best way to setup a new computer for users is to deploy customized images to the new machines. Generally, you would install Windows on a test machine or VM, customize the default profile, sysprep and capture the image. When a new machine arrives, deploy the image and give it to the user. With the proper tools, this can be a fast simple operation where you will have minimal interaction with the machine, and can apply images to multiple machines at the same time. Using a combination of customized images and Group Policy, you can achieve your goals without needing to log in as the user at all.

Microsoft has many free deployment tools to help. The Microsoft Deployment Toolkit (MDT), is a common console for many of Microsoft’s other free deployment tools, such as the Windows Assessment and Deployment Kit (WADK – this has replaced WAIK), User State Migration Tool (USMT), and many more. And MDT will work with Windows Deployment Services (WDS) which is a role on your Windows Servers and allows network booting and delivery of your images. MDT will manage device drivers and updates, and will even install software during the Windows deployment. Programs that have frequent updates or when new drivers are released can be changed in MDT without having to load the image, install updates and re-capture the image.

A short video that shows a quick overview of MDT: Deployment Workbench in Microsoft Deployment Toolkit 2010 (latest version is 2012, but basically the same)

This is a longer video that is a deep dive into MDT and several other deployment tools: Alphabet Soup Deployment: Understanding MDT, WDS, MAP, ACT, SCCM, and USMT

I also recommend you go to the Springboard Series for Windows 7 on TechNet. There are many articles and videos to help you get started with deploying Windows.

Hope this helps

share|improve this answer
add comment

Typically, if you need to perform per-user setup, they need to give you their password on a stickynote. While I'm sure that there are tons of security implications regarding this, and some users may not be comfortable giving out their password like that, it's the most effective way to do the job. You're the admin, after all. You're supposed to be trusted, and it's not like anything is stopping you from wreaking havoc if you suddenly turned evil.

share|improve this answer
    
This is what I assumed... It is what I've seen in many other places. We don't have in-house IT, so I end up setting things up to save a bit of time / money. Not that I mind asking for peoples passwords, just wondered if there was a way to do this that I didn't know about. Would be a nice feature! Garage doors can do it, why can't windows! –  McB Jan 16 '13 at 21:54
    
John is right in that you need to try and automate as much as possible either on the base image, or via group policy. There may be some things that you won't be able to do without logging in as the user though (initial Outlook setup comes to mind... yeah, Autodiscover, but you can't rely on everyone being able to click through it and know what they're doing). –  Bigbio2002 Jan 16 '13 at 23:32
add comment

IMHO, your best bet from a maintainability standpoint is to set up GPOs that make the changes you need made, associate them with the appropriate computer or user groups, and don't do anything by hand. Your worst bet (again IMHO) is to change a user's password for them - this can cause Upset Users to appear when they can't get in to something they wanted to get in to just as you changed their password.

share|improve this answer
    
I agree, a job for a Software Group Policy rather than upsetting the users. –  Guy Thomas Jan 14 '13 at 20:27
    
Thanks. Makes sense, just wanted to see if I was missing something on the per user setup. –  McB Jan 16 '13 at 21:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.